Loophole Timing Attacks on Shared Event Loops in Chrome Pepe Vila - PowerPoint PPT Presentation

Loophole Timing Attacks on Shared Event Loops in Chrome Pepe Vila November 22, 2016 Pepe Vila Loophole November 22, 2016 1 / 22

Introduction Event-driven programming Event loops A timing side-channel on event loops Pepe Vila Loophole November 22, 2016 2 / 22

Introduction: Event-driven programming EDP is a programming paradigm for GUI, web clients, networks and server-side 1 https://html.spec.whatwg.org/#event-loop Pepe Vila Loophole November 22, 2016 3 / 22

Introduction: Event-driven programming EDP is a programming paradigm for GUI, web clients, networks and server-side The flow of the program is determined by events or messages 1 https://html.spec.whatwg.org/#event-loop Pepe Vila Loophole November 22, 2016 3 / 22

Introduction: Event-driven programming EDP is a programming paradigm for GUI, web clients, networks and server-side The flow of the program is determined by events or messages Examples: Nginx, Node.js or memcached Used for message passing: inter-(thread | process) communication HTML5 standard 1 mandates user agents to use EDP: 1 https://html.spec.whatwg.org/#event-loop Pepe Vila Loophole November 22, 2016 3 / 22

Introduction: Event loops Event loop, message dispatcher, message loop, or run loop Pepe Vila Loophole November 22, 2016 4 / 22

Introduction: Event loops Event loop, message dispatcher, message loop, or run loop FIFO queue & dispatcher: Q = []; while (true) { M = Q.shift (); // dequeue process(M); } Pepe Vila Loophole November 22, 2016 4 / 22

Introduction: Event loops Event loop, message dispatcher, message loop, or run loop FIFO queue & dispatcher: Q = []; while (true) { M = Q.shift (); // dequeue process(M); } If queue is empty, waits until an event arrives Pepe Vila Loophole November 22, 2016 4 / 22

Introduction: Event loops Event loop, message dispatcher, message loop, or run loop FIFO queue & dispatcher: Q = []; while (true) { M = Q.shift (); // dequeue process(M); } If queue is empty, waits until an event arrives Blocking operations (e.g., database and network requests) are dealt with asynchronously Pepe Vila Loophole November 22, 2016 4 / 22

Introduction: Event loops Event loop, message dispatcher, message loop, or run loop FIFO queue & dispatcher: Q = []; while (true) { M = Q.shift (); // dequeue process(M); } If queue is empty, waits until an event arrives Blocking operations (e.g., database and network requests) are dealt with asynchronously Simple concurrency model for programmers Pepe Vila Loophole November 22, 2016 4 / 22

Introduction: A timing side-channel on event loops Event loops are susceptible to timing side-channel attacks: Pepe Vila Loophole November 22, 2016 5 / 22

Introduction: A timing side-channel on event loops Event loops are susceptible to timing side-channel attacks: when shared between mutually distrusting programs Pepe Vila Loophole November 22, 2016 5 / 22

Our work (in poetry) “Loophole” Exploit a timing side-channel in the Chrome web browser to break user privacy using machine learning techniques - Abraham Lincoln Pepe Vila Loophole November 22, 2016 6 / 22

Chrome’s architecture Same Origin Policy (SOP) Multi-process Shared event loops Pepe Vila Loophole November 22, 2016 7 / 22

Chrome’s architecture: Same Origin Policy (SOP) Central concept in the web security model Script from a site A can not access data from site V if origins differ: Origin := (scheme, domain, port ) Pepe Vila Loophole November 22, 2016 8 / 22

Chrome’s architecture: Same Origin Policy (SOP) Central concept in the web security model Script from a site A can not access data from site V if origins differ: Origin := (scheme, domain, port ) Origin 1 Origin 2 http://example.com:8080 http://example.com http://mail.example.com http://app.example.com https://foo.example.com https://foo.example.com https://example.com http://example.com Pepe Vila Loophole November 22, 2016 8 / 22

Chrome’s architecture: Multi-process Multi-process: 1 privileged host — N sandboxed renderers 2 Chrome’s implementation of an event loop Pepe Vila Loophole November 22, 2016 9 / 22

Chrome’s architecture: Multi-process Multi-process: 1 privileged host — N sandboxed renderers Each process has multiple threads. Each thread one message loop 2 2 Chrome’s implementation of an event loop Pepe Vila Loophole November 22, 2016 9 / 22

Chrome’s architecture: Multi-process Multi-process: 1 privileged host — N sandboxed renderers Each process has multiple threads. Each thread one message loop 2 DEMO: Chrome’s task manager 2 Chrome’s implementation of an event loop Pepe Vila Loophole November 22, 2016 9 / 22

Chrome’s architecture: Shared event loops Different policies for mapping applications into renderer processes (default: process-per-site-instance ) A Site is a registered domain plus a scheme Pepe Vila Loophole November 22, 2016 10 / 22

Chrome’s architecture: Shared event loops Different policies for mapping applications into renderer processes (default: process-per-site-instance ) A Site is a registered domain plus a scheme (different than SOP) Pepe Vila Loophole November 22, 2016 10 / 22

Chrome’s architecture: Shared event loops Different policies for mapping applications into renderer processes (default: process-per-site-instance ) A Site is a registered domain plus a scheme (different than SOP) Sharing the renderer ◮ When using iframes, linked nagivation or | processes | > T ◮ T = 32 for 4 GB of RAM, and T = 70 for 8 GB or more Pepe Vila Loophole November 22, 2016 10 / 22

Chrome’s architecture: Shared event loops Different policies for mapping applications into renderer processes (default: process-per-site-instance ) A Site is a registered domain plus a scheme (different than SOP) Sharing the renderer ◮ When using iframes, linked nagivation or | processes | > T ◮ T = 32 for 4 GB of RAM, and T = 70 for 8 GB or more Sharing the host process ◮ One for all renderers ◮ IPC through I/O thread Pepe Vila Loophole November 22, 2016 10 / 22

Spying on shared event loops Main thread of a renderer I/O thread of the host process Pepe Vila Loophole November 22, 2016 11 / 22

Spying on shared event loops Main thread of renderer processes Pepe Vila Loophole November 22, 2016 12 / 22

Spying on shared event loops Main thread of renderer processes ◮ runs resource parsing, style calculation, layout, painting and Javascript ◮ each task blocks the event loop for a while ◮ when 2 pages share the process, the main thread’s event loop is shared ◮ A can eavesdrop information from V ’s tasks Pepe Vila Loophole November 22, 2016 12 / 22

Spying on shared event loops Main thread of renderer processes ◮ runs resource parsing, style calculation, layout, painting and Javascript ◮ each task blocks the event loop for a while ◮ when 2 pages share the process, the main thread’s event loop is shared ◮ A can eavesdrop information from V ’s tasks I/O thread of the host process ◮ manages IPC with all children renderers ◮ demultiplexes all UI events to each corresponding renderer ◮ multiplexes all network requests from renderers ◮ each task/message/event also blocks the event loop Pepe Vila Loophole November 22, 2016 12 / 22

Spying on shared event loops Main thread of renderer processes ◮ runs resource parsing, style calculation, layout, painting and Javascript ◮ each task blocks the event loop for a while ◮ when 2 pages share the process, the main thread’s event loop is shared ◮ A can eavesdrop information from V ’s tasks I/O thread of the host process ◮ manages IPC with all children renderers ◮ demultiplexes all UI events to each corresponding renderer ◮ multiplexes all network requests from renderers ◮ each task/message/event also blocks the event loop Some tasks are very fast ( << 0 . 1 ms). We need high timing resolution. Pepe Vila Loophole November 22, 2016 12 / 22

Spying on shared event loops: renderer’s main thread Monitor the event loop from an arbitrary HTML page running Javascript: function loop () { save( performance .now ()); // high -resolution timestamp self. postMessage (0,’*’); // recursive invocation } self.onmessage = loop; // set event handler self. postMessage (0,’*’); // post first async task Pepe Vila Loophole November 22, 2016 13 / 22

Spying on shared event loops: renderer’s main thread Monitor the event loop from an arbitrary HTML page running Javascript: function loop () { save( performance .now ()); // high -resolution timestamp self. postMessage (0,’*’); // recursive invocation } self.onmessage = loop; // set event handler self. postMessage (0,’*’); // post first async task 1 Generates a trace of timing measurements 2 Resolution ≈ 25 µ s Pepe Vila Loophole November 22, 2016 13 / 22

Spying on shared event loops: host’s I/O thread Monitor the loop from any HTML page running Javascript: function loop () { save( performance .now ()); fetch(new Request(’http ://0.0.0.0 ’)).catch(loop); } loop (); Pepe Vila Loophole November 22, 2016 14 / 22